CCSP Practice Test 11 — 15 Questions

Question 1

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Option A is correct because client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 2

An organization uses a cloud-based DLP solution to monitor outbound traffic. They want to prevent the exfiltration of credit card numbers. Which detection technique is most appropriate for this requirement?

Accepted Answer

Regular expression matching for credit card number patterns. Regular expression matching (option D) is the most appropriate technique because credit card numbers follow well-defined, predictable patterns (e.g., 16 digits, specific starting digits for each issuer like 4 for Visa, 5 for MasterCard, and Luhn algorithm validation). This allows the DLP solution to detect credit card numbers in outbound traffic without requiring a pre-populated list or prior training, making it ideal for real-time monitoring of unknown or new card numbers.

Answer

Exact data matching against a list of known card numbers

Answer

Machine learning classification of sensitive data

Answer

Fingerprinting of known credit card documents

Question 3

An organization stores archival data in cloud cold storage and requires each customer's data to be encrypted with unique keys managed by the customer. Which encryption approach meets this requirement?

Accepted Answer

Client-side encryption. Client-side encryption ensures that data is encrypted before it is sent to the cloud, and the customer retains sole control over the encryption keys. This approach meets the requirement for each customer's data to be encrypted with unique keys managed by the customer, as the cloud provider never has access to the keys or the unencrypted data.

Answer

Server-side encryption with customer-managed keys (SSE-KMS)

Answer

Server-side encryption with cloud-provider keys (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Question 4

Which TWO data states must be encrypted to meet common compliance requirements for data in the cloud? (Choose two.)

Accepted Answer

Data at rest. Data at rest (C) must be encrypted because compliance frameworks like PCI DSS, HIPAA, and GDPR require protection of stored data against unauthorized access. Encryption at rest typically uses AES-256 or similar algorithms to secure data on disks, databases, or object storage, ensuring that even if physical media is compromised, the data remains unreadable.

Answer

Data in audit logs

Answer

Data in backup

Answer

Data in use

Question 5

A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?

Accepted Answer

Configure the cloud service to require all API requests to go through a proxy that enforces DLP. Option B is correct because routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.

Answer

Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN

Answer

Implement a conditional access policy to block non-corporate devices

Answer

Use tokenization to replace sensitive data before allowing API access

Question 6

Based on the CloudTrail log, why did the Decrypt call fail?

Accepted Answer

The key policy denied access.. The Decrypt call failed because the key policy attached to the AWS KMS CMK explicitly denied the IAM role or user making the request. CloudTrail logs show the error code 'AccessDenied' or 'UnauthorizedOperation', which indicates that the key policy did not grant the necessary kms:Decrypt permission to the principal. Even if the CMK is enabled and the ciphertext is valid, a restrictive key policy will block the operation.

Answer

The encryption algorithm mismatch.

Answer

The ciphertext was tampered.

Answer

The CMK was disabled.

Question 7

A company's cloud storage bucket policy inadvertently allowed anonymous users to list and read objects. After discovering the exposure, the security team has corrected the policy. Which additional step is critical to prevent recurrence?

Accepted Answer

Implement automated policy validation as part of the infrastructure as code deployment process.. Option D is correct because implementing automated policy validation as part of the infrastructure as code (IaC) deployment process ensures that any bucket policy changes are automatically checked against security rules before they are applied. This prevents misconfigurations like allowing anonymous access from reaching production, addressing the root cause rather than just reacting after exposure. In cloud environments like AWS S3, tools such as AWS CloudFormation with cfn-nag or Terraform with Sentinel can enforce policies programmatically, eliminating human error in manual reviews.

Answer

Enable logging and monitoring to detect similar exposures.

Answer

Assign a dedicated security team to manually approve all policy changes.

Answer

Review all existing bucket policies and correct any other misconfigurations.

Question 8

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. Option A is correct because a multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 9

An enterprise uses a Cloud Access Security Broker (CASB) to monitor cloud application usage. The CASB generates alerts about potential data loss prevention events. What is the primary purpose of the CASB's DLP capabilities?

Accepted Answer

To detect and prevent unauthorized sharing of sensitive data based on policies. The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Answer

To block all uploads of sensitive data to cloud apps

Answer

To classify data automatically using machine learning

Answer

To encrypt data before it is sent to cloud apps

Question 10

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

Accepted Answer

Enable immutable storage (WORM) on the bucket. Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Answer

Implement data classification labels

Answer

Enable versioning on the storage bucket

Answer

Encrypt data with customer-managed keys

Question 11

Which THREE of the following are effective data sanitization methods for cloud environments?

Accepted Answer

Degaussing magnetic media. Degaussing (A) is effective because it uses a strong magnetic field to completely randomize the magnetic domains on hard disk drives (HDDs), rendering all stored data unrecoverable even with advanced forensic tools. This method is approved for the highest security classifications (e.g., NSA/CSS Policy Manual 9-12) but physically destroys the media's ability to store data, making it suitable only for end-of-life disposal.

Answer

Truncating database tables

Answer

Formatting storage volumes

Question 12

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 13

A company uses a cloud-based database that contains personally identifiable information (PII). They need to allow developers to run queries against the database for testing purposes without exposing actual PII. Which technique should they use?

Accepted Answer

Apply dynamic data masking to the PII columns. Option C is correct because dynamic data masking (DDM) allows the database to return masked PII to developers in real time without altering the underlying stored data. This technique applies masking rules at query runtime, so developers can run functional tests against production-like data while sensitive values are obfuscated. It avoids the need for separate sanitized copies and preserves referential integrity for testing.

Answer

Encrypt the PII fields at rest

Answer

Grant developers direct access to a copy of the production data

Answer

Tokenize the PII fields with a one-way hash

Question 14

A developer accidentally uploaded a file containing API credentials to a public cloud storage bucket. The cloud provider states they cannot guarantee deletion of the object. Which practice could have prevented this incident?

Accepted Answer

Data loss prevention for cloud storage. Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Answer

Bucket versioning

Answer

Access control lists

Answer

Server-side encryption

Question 15

An organization is evaluating techniques to protect data while it is being processed in memory. The goal is to prevent unauthorized access even if the operating system or hypervisor is compromised. Which TWO techniques are suitable for protecting data in use?

Accepted Answer

Secure enclaves (e.g., Intel SGX). Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

Answer

Hashing

Answer

Data masking

Answer

Tokenization